hasura / hasura/graphql-engine
Allow masking of error messages for security reasons
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Issue
When using Hasura as our GraphQL endpoint we need a way to mask error messages as these might be too detailed and expose internal information regarding the schema/technologies we use.
This is actually a comment we got during SOC2 Compliance tests...
### Suggested solution
Similar to the HASURA_GRAPHQL_DEV_MODE environment variable, to have a ERRORS_DETAIL_LEVEL that helps mask the errors.
* The default level can be the errors as they are now
* Somewhat masked level can be just some general errors messages like "Authentication Error", "Parsing Error" etc
* The most masked level can be just "Error occurred"
Or any other solution :)
Contributor guide
Research direction
Start by reviewing how HASURA_GRAPHQL_DEV_MODE affects errors exposed through the GraphQL endpoint. Compare the proposed default, partially masked, and fully masked levels, and define what information must no longer be revealed for SOC2 compliance. Done means error responses can be configured without exposing detailed schema or technology information.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100